linux/include/net/ipv6.h, branch v3.9

ipv6: use a stronger hash for tcp

2013-02-21T23:15:58Z

It looks like its possible to open thousands of TCP IPv6 sessions on a server, all landing in a single slot of TCP hash table. Incoming packets have to lookup sockets in a very long list. We should hash all bits from foreign IPv6 addresses, using a salt and hash mix, not a simple XOR. inet6_ehashfn() can also separately use the ports, instead of xoring them. Reported-by: Neal Cardwell Signed-off-by: Eric Dumazet Cc: Yuchung Cheng Signed-off-by: David S. Miller

ipv6 flowlabel: Convert np->ipv6_fl_list to RCU.

2013-01-31T03:41:13Z

Signed-off-by: YOSHIFUJI Hideaki Signed-off-by: David S. Miller

ipv6 flowlabel: Convert hash list to RCU.

2013-01-31T03:41:13Z

Signed-off-by: YOSHIFUJI Hideaki Signed-off-by: David S. Miller

net: frag helper functions for mem limit tracking

2013-01-29T18:36:24Z

This change is primarily a preparation to ease the extension of memory limit tracking. The change does reduce the number atomic operation, during freeing of a frag queue. This does introduce a some performance improvement, as these atomic operations are at the core of the performance problems seen on NUMA systems. Signed-off-by: Jesper Dangaard Brouer Signed-off-by: David S. Miller

ipv6: Unshare ip6_nd_hdr() and change return type to void.

2013-01-21T18:33:15Z

- move ip6_nd_hdr() to its users' source files. In net/ipv6/mcast.c, it will be called ip6_mc_hdr(). - make return type to void since this function never fails. Signed-off-by: YOSHIFUJI Hideaki Signed-off-by: David S. Miller

ipv6: fix ipv6_prefix_equal64_half mask conversion

2013-01-17T19:29:58Z

Fix the 64bit optimized version of ipv6_prefix_equal to convert the bitmask to network byte order only after the bit-shift. The bug was introduced in: 3867517 ipv6: 64bit version of ipv6_prefix_equal(). Signed-off-by: Fabio Baltieri Signed-off-by: David S. Miller

net: increase fragment memory usage limits

2013-01-17T19:29:53Z

Increase the amount of memory usage limits for incomplete IP fragments. Arguing for new thresh high/low values: High threshold = 4 MBytes Low threshold = 3 MBytes The fragmentation memory accounting code, tries to account for the real memory usage, by measuring both the size of frag queue struct (inet_frag_queue (ipv4:ipq/ipv6:frag_queue)) and the SKB's truesize. We want to be able to handle/hold-on-to enough fragments, to ensure good performance, without causing incomplete fragments to hurt scalability, by causing the number of inet_frag_queue to grow too much (resulting longer searches for frag queues). For IPv4, how much memory does the largest frag consume. Maximum size fragment is 64K, which is approx 44 fragments with MTU(1500) sized packets. Sizeof(struct ipq) is 200. A 1500 byte packet results in a truesize of 2944 (not 2048 as I first assumed) (44*2944)+200 = 129736 bytes The current default high thresh of 262144 bytes, is obviously problematic, as only two 64K fragments can fit in the queue at the same time. How many 64K fragment can we fit into 4 MBytes: 4*2^20/((44*2944)+200) = 32.34 fragment in queues An attacker could send a separate/distinct fake fragment packets per queue, causing us to allocate one inet_frag_queue per packet, and thus attacking the hash table and its lists. How many frag queue do we need to store, and given a current hash size of 64, what is the average list length. Using one MTU sized fragment per inet_frag_queue, each consuming (2944+200) 3144 bytes. 4*2^20/(2944+200) = 1334 frag queues -> 21 avg list length An attack could send small fragments, the smallest packet I could send resulted in a truesize of 896 bytes (I'm a little surprised by this). 4*2^20/(896+200) = 3827 frag queues -> 59 avg list length When increasing these number, we also need to followup with improvements, that is going to help scalability. Simply increasing the hash size, is not enough as the current implementation does not have a per hash bucket locking. Signed-off-by: Jesper Dangaard Brouer Signed-off-by: David S. Miller

ipv6: Fix endianess warning in ip6_flow_hdr().

2013-01-17T03:12:36Z

Commit 3e4e4c1f ("ipv6: Introduce ip6_flow_hdr() to fill version, tclass and flowlabel.) uses ntohl(), which should be htonl(). Found by Fengguang Wu . Signed-off-by: YOSHIFUJI Hideaki Signed-off-by: David S. Miller

ipv6: 64bit version of ipv6_prefix_equal().

2013-01-14T18:17:01Z

Signed-off-by: YOSHIFUJI Hideaki Signed-off-by: David S. Miller

ipv6: Remove __ipv6_prefix_equal().

2013-01-14T18:17:01Z

ipv6_prefix_equal() just casts its arguments and it is the only user of __ipv6_prefix_equal(). Signed-off-by: YOSHIFUJI Hideaki Signed-off-by: David S. Miller